Remailer chain length?

Hi Mark,

Forwarded message:

> Date: Tue, 28 May 1996 16:21:22 -0400 (EDT)
> From: "Mark M." <markm@voicenet.com>
> Subject: Re: Quickremail v1.0b
> 
> > At 17:28 1996-05-27 EDT, E. ALLEN SMITH wrote:
> > >I'm planning on starting up a remailer, probably on Lance's machine (to
> > >take advantage of his expertise) sometime this summer. I do want to get PGP
> > >for the VAX before then, and the MIT site doesn't appear to have this code.
> > 
> > Why would anyone set up a remailer at Lance's (or Sameer's) machine?
> > They have remailers running already. If the thugs break root and obtain
> > one remailer key from a machine, they probably get all the keys on that
> > machine, compromising all the remailers in one single attack. Or am I
> > missing something? Is there any benefit of multiple remailers on a machine
> > where root is running his own remailer?
> 
> It's better than nothing.  And besides, the more remailers there are, the
> more difficult it is to do traffic analysis on remailer traffic.  Actually,
> its the more remailers people chain messages through, but there are software
> packages that can do this easily.  The more remailers there are, the longer
> remailer chains have the possibility of becoming.

If this is strictly true, why not simply run several instances of a remailer
on the same machine. Then randomly chain them prior to sending them off
site. This would be a lot cheaper and faster than trying to convince
hobbyist to set it up or businesses to to use their profit & legal council.


                                                        Jim Choate

Jim Choate writes:
>> It's better than nothing.  And besides, the more remailers there are, the
>> more difficult it is to do traffic analysis on remailer traffic.  Actually,
>> its the more remailers people chain messages through, but there are software
>> packages that can do this easily.  The more remailers there are, the longer
>> remailer chains have the possibility of becoming.
>
>If this is strictly true, why not simply run several instances of a remailer
>on the same machine. Then randomly chain them prior to sending them off
>site. This would be a lot cheaper and faster than trying to convince
>hobbyist to set it up or businesses to to use their profit & legal council.

Because it's not strictly true.  Implicit in traffic analysis is looking
at the "envelopes" of the traffic.  Since this means intercepting those
envelopes, once you've put your monitor on the first remailer at a site,
you've probably gotten all the rest at the site for free.

I don't think multiple remailers at the same site help anything.